Sophos AV for Linux - how to enable quarantine on-access scanning

Hello Paul Nerie,

the available actions for on-access detections are disinfect and delete. Both are disabled by default. quarantine is only available for on-demand scans (savscan).
AFAIK the on-access scanner permits deletes so the files might have been deleted by the application.

Christian

Thanks Christian.

I'm actually not sure if the files were deleted by the on-access scan since they are in the temp folders. They may have been deleted automatically.

Also if the disinfect and delete options are disabled by default (and I haven't enabled them), then it's almost sure that they weren't deleted by the on-access scan.

Would you know how to enable disinfect option by default?

- Paul

Hello Paul,

as per section 15.5.1 in the configuration guide: /opt/sophos-av/bin/savconfig add AutomaticAction disinfect.

Christian

Thanks again! I'll check it out.